Rule-based mode: ruleCore ecosystem mihomoConfig format YAML
Clash Configuration and Core Features
Understand where your config comes from, what handles your connections, and how rules match before changing settings.
Routing Rules
Match by domain Route by policy
Rule mode routes different connections through different exits, so you don’t have to keep switching between direct and global proxy modes. After importing a config, make sure a working node is selected in the proxy group, then check the connection log to see which rule matched. Rules are usually evaluated from top to bottom: put specific domains before broad rules, and use MATCH to catch everything else. Unlike a single proxy address, rule-based routing lets you keep local network traffic direct while proxying selected sites. For custom rules you want to keep, use the client’s override feature so a subscription refresh won’t remove them.
A subscription provides your configuration; it doesn’t mean the client itself provides network service. Paste an existing Clash-compatible URL into the subscription or config page, wait for it to download, then select it as the active config. Subscriptions make it easier to update nodes, proxy groups, and rules together, but what gets refreshed depends on what the provider includes. If an update fails, check that the URL is complete and hasn’t expired, then review the request error. Keep personal rules and DNS changes separate from remote content. Before enabling automatic updates, refresh manually and confirm your existing settings still work.
Some apps don’t use the system proxy, and enabling a browser proxy won’t necessarily cover their traffic. TUN takes over traffic through a virtual network interface, letting the core handle more apps, but results still depend on system routes, permissions, and app behavior. First make sure a regular proxy connection works. Then follow the client’s prompts to install its service or grant VPN permissions, and check DNS hijacking and automatic routing settings. TUN operates deeper in the network stack than the system proxy and is more likely to conflict with another VPN or virtual adapter. If your connection drops, turn TUN off first, then use the logs to adjust settings one at a time.
Choose the right architecture Then migrate your config
Being part of the Clash ecosystem doesn’t mean every client has the same settings, core features, or permission flow. On desktop, check your processor architecture first; on mobile, confirm the subscription format and VPN permissions. Also make sure the target client supports the protocols and rule fields in your existing config. Rather than copying an entire config directory, import the subscription first and migrate overrides one at a time to make issues easier to trace. The download center lists clients and installation guides by operating system. Most users should start with a graphical client; server and router users can consider the standalone core and manage service startup, logs, and config directories themselves.
The interface is a settings illustration; its switches are not interactive. The code shows selected fields, not a complete config. PROXY must match an existing proxy group. Features vary by client.
Clash Client Downloads by Platform
Choose your operating system first, then check architecture and installation requirements. This link opens the download center; it won’t start a download.
Start with Clash Plus, or compare Clash Verge Rev, FlClash, and Clash Nyanpasu. Before installing, check your processor type in system settings; system bitness and app architecture aren’t the same thing.
On first launch, import a config before enabling the system proxy. If you need TUN, install the service as prompted and check whether your firewall is blocking the client. Quit any other proxy software before testing. Clash for Windows is no longer maintained, so consider an actively maintained option for a new installation.
Check the chip information in About This Mac to choose the Apple silicon or Intel installer. Clash Plus, Clash Verge Rev, and FlClash each have a different interface and feature set; review the installation requirements before choosing.
Move the app to Applications before opening it, then follow any prompts for network permissions or service installation. If a Keychain dialog appears, confirm which app is requesting access and why. Don’t disable system protections just to skip a step. You can refer to your old client’s config, but grant permissions again in the new app.
Choose from Clash Plus, Clash Meta for Android, FlClash, and Surfboard. Along with system architecture, check subscription format: config syntax varies between tools, so a file extension alone doesn’t tell you whether it’s compatible.
After importing and activating a config, grant VPN permission when prompted on the first connection. If the connection drops after the screen has been off for a while, check battery optimization, background activity, and power-saving settings. Per-app routing depends on both the client and the operating system. Review the app list again when moving to a new device; paths from the old device may not apply.
The download center links to Clash Plus on the App Store. The project website is clashplus.io. After installation, have an existing subscription ready, import it in the app, and confirm the prompt to add a VPN configuration.
For your first test, keep the default settings, select a working policy, and check the connection in the app you want to use. If you already have another VPN configuration, check which one is active. Importing a subscription doesn’t guarantee that every desktop config option will work as-is. If a field isn’t supported, follow the app’s documentation instead of repeatedly reinstalling it.
For desktop Linux, see Clash Verge Rev and FlClash, and choose the package for your distribution. Headless servers can run the mihomo core, but you’ll need to provide the config file, service unit, and runtime permissions yourself.
Desktop proxy settings may not affect terminal apps; command-line tools often need proxy environment variables or their own proxy options. When deploying a systemd service, use explicit config and working directories, then check the service logs to confirm it started. Before enabling TUN on a remote machine, keep your management connection available so route changes don’t lock you out.
The Clash Open-Source Ecosystem and Project Boundaries
The client handles interaction, the core handles connections, and the subscription provides the config. Identify the layer involved before troubleshooting.
From Clash to mihomo
Many graphical clients use Clash-style rule configuration. After the original project was discontinued, the community developed different cores and interfaces, with mihomo continuing and expanding related capabilities. So when you find an app with Clash in its name, check which core it actually uses and whether it’s maintained. Fields, screenshots, and steps from older guides aren’t universal standards across all clients.
Graphical Clients and Proxy Cores
Graphical clients usually provide subscription lists, tray menus, system proxy switches, and service installation. The core handles protocol connections, rule matching, and DNS. If the interface starts but the proxy doesn’t work, check the core logs and whether the config loaded successfully. Conversely, a command-line core can run normally without the desktop system proxy being enabled. Understanding this separation is the first step to troubleshooting.
Project Resources
Source code, commit history, issue discussions, and release notes can help you verify where a feature comes from. This site provides download links and setup guides, but isn’t a project maintainer and doesn’t provide proxy nodes. To check what a mihomo field does, start with the project repository, then use the client’s own override mechanism. Check each client’s project documentation for its permissions, features, and update schedule.
Keep a Recoverable Config Before Updating
Updating the client, updating the core, and refreshing a subscription are three different things. The first two can change features or defaults; a subscription refresh can replace nodes, proxy groups, and rules. Back up personal overrides and essential settings before updating, review compatibility notes, then test your usual sites and local network access. Don’t judge connection status just by whether the update finished, and don’t change the client, subscription, and DNS all at once if you need to find the cause of a problem.
First Connection and Common Questions
Why do I need a subscription after downloading Clash?
The client runs the proxy; the subscription provides nodes and a config. They’re separate. Get a compatible subscription URL, import and activate it on the config page, then select a proxy group. If you only have a link for a single node using a specific protocol, first check whether the client can import it directly. Not every link is a Clash config URL. See the subscription import guide for details.
Should I change DNS first if a subscription update fails?
First check that the URL is complete and hasn’t expired, then review the error log. A timeout, permission denial, and config parsing error are different problems with different fixes. Subscription conversion also involves deciding who processes your config; use a compatible output from a source you trust, and avoid submitting personal URLs to unknown services. Read the subscription conversion guide, then troubleshoot based on the error.
Why don’t some apps change when the system proxy is on?
Some apps don’t use the system proxy, while others have their own network settings. First confirm the proxy works in a browser and check whether the target request appears in the connection log. Once you know what traffic the client is handling, decide whether you need TUN. One app’s result doesn’t prove that all your rules are broken. See the Clash setup guide for a step-by-step first connection check.
Rule mode or global mode: which should I use day to day?
When your rules are complete, start with rule mode for everyday use and choose an exit based on the domain or destination address. Global mode can help with temporary comparisons, but it won’t fix an unavailable node or a bad subscription. If only rule mode fails, check the match log and proxy group instead of staying in global mode to hide the problem. Follow the mode selection and testing steps in the guide to check each part.
Clash Tips and Configuration Explained
Once your first connection is working, explore the topics that match your needs. Here are the three most recent articles, newest first.
Explains the fields in the dns section, compares fake-ip with redir-host, and shows how to configure fallback-filter and DNS hijacking to reduce DNS pollution and leaks.
For users with a working connection who want to understand how domain lookups are resolved. Distinguish upstream DNS, rule matching, and the actual route before deciding whether to override DNS settings in a subscription.
Learn what latency test results really mean, how traffic multipliers affect data usage, which regions suit different needs, and how protocols such as Trojan, VMess, and Hysteria2 differ.
Don’t choose a node based on one test. Consider the service you’re accessing, how it performs in the evening, and your subscription’s billing rules to distinguish routing issues, regional restrictions, and changes to your local network.
Covers installer selection, the firewall prompt on first launch, service mode and TUN adapter installation, and common reasons the system proxy may not work when enabled.
Follow the steps from installation through testing, and learn to tell whether the client failed to start the core, the system isn’t routing requests through it, or the node itself is unavailable. Keeping logs and noting each step makes it easier to pinpoint the cause than repeatedly reinstalling.